From a162e95a049a83c3bdc61c73df04a7411b90a40b Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Sat, 22 Jan 2022 15:12:04 +0100 Subject: [PATCH] bpo-46417: Debug tp_subclasses crash * _PyType_GetSubclasses() no longer holds a reference to tp_subclasses: its loop cannot modify tp_subclasses. * remove_subclass() now sets tp_subclasses to NULL if the dictionary becomes empty. --- Objects/typeobject.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 2b47afe30e6ecb..604a89f10a8227 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -4138,7 +4138,7 @@ _PyType_GetSubclasses(PyTypeObject *self) } // Hold a strong reference to tp_subclasses while iterating on it - PyObject *dict = Py_XNewRef(self->tp_subclasses); + PyObject *dict = self->tp_subclasses; if (dict == NULL) { return list; } @@ -4159,7 +4159,6 @@ _PyType_GetSubclasses(PyTypeObject *self) } } done: - Py_DECREF(dict); return list; } @@ -6568,6 +6567,10 @@ remove_subclass(PyTypeObject *base, PyTypeObject *type) PyErr_Clear(); } Py_XDECREF(key); + + if (PyDict_Size(dict) == 0) { + Py_CLEAR(base->tp_subclasses); + } } static void